The RabbitMQ management UI in versions before 4.2.5 improperly escapes the x-internal-purpose argument for queues or exchanges when rendering it into an HTML title attribute on the Queues and Exchanges pages. This improper escaping leads to a cross-site scripting (XSS) vulnerability, enabling a user with permission to declare a queue or exchange to execute arbitrary JavaScript in the browsers of other users viewing these pages. The vulnerability is resolved in RabbitMQ version 4.2.5.

An attacker with permission to declare queues or exchanges can exploit this vulnerability to execute arbitrary JavaScript in the context of other users' browsers accessing the RabbitMQ management UI. This could lead to session hijacking, information disclosure, or other client-side attacks. There is no indication of privilege escalation or server-side compromise from this vulnerability alone.

This vulnerability is fixed in RabbitMQ version 4.2.5. Users should upgrade to version 4.2.5 or later to remediate this issue. No other mitigation or temporary workaround is indicated.